Attack - 1530 - Final 1
Which of the following is an attack where all traffic is blocked by taking up all available bandwidth between the target computer and the Internet?
Volumetric attack
Which of the following actions was performed while using the WinDump command line sniffer?
Wrote packet capture files from interface 1 into mycap.pcap.
Which of the following describes a session ID?
A unique token that a server assigns for the duration of a client's communications with the server.
Which of the following best describes a phishing attack?
A user is tricked into believing that a legitimate website is requesting their login information.
Jason, an attacker, has manipulated a client's connection to disconnect the real client and allow the server to think that he is the authenticated user. Which of the following describes what he has done?
Active hijacking
Which of the following is an open-source web server technology?
Apache Web Server
Frank wants to do a penetration test. He is looking for a tool that checks for vulnerabilities in web applications, network systems, wireless networks, mobile devices, and defense systems such as IDS or IPS. Which of the following tools would you recommend to him?
COREImpact Pro
Which of the following are network sniffing tools?
Cain and Able, Ettercap and TCPDump
In 2011, Sony was targeted by an SQL injection attack that compromised over a million emails, usernames, and passwords. Which of the following could have prevented the attack?
Careful configuration and penetration testing on the front end.
Which type of web application requires a separate application to be installed before you can use the app?
Client-based web app
A hacker has used an SQL injection to deface a web page by inserting malicious content and altering the contents of the database. Which of the following did the hacker accomplish?
Compromise data integrity
Firewalls, whether hardware or software, are only as effective as their ?
Configuration
Ping of death, teardrop, SYN flood, Smurf, and fraggle are all example of which of the following?
DoS attack types
Which of the following is a sign of a network-based intrusion?
New or unusual protocols and services running.
Which of the following best describes a reverse proxy method for protecting a system from a DoS attack?
Redirects all traffic before it is forwarded to a server, so the redirected system takes the impact.
Upload bombing and poison null byte attacks are designed to target which of the following web application vulnerabilities?
Scripting errors
Which of the following footprinting methods would you use to scan a web server to find ports that the web server is using for various services?
Service discovery
It is important to be prepare for a DoS attack. These attacks are becoming more common. Which of the following best describes the response you should take for a service degradation?
Services can be set to throttle or even shut down.
1. Sniff the traffic between the target computer and the server. 2. Monitor traffic with the goal of predicting the packet sequence numbers. 3. Desynchronize the current session. 4. Predict the session ID and take over the session. 5. Inject commands to target the server?
Session Hijacking
Using Wireshark filtering, you want to see all traffic except IP address 192.168.142.3. Which of the following is the best command to filter a specific source IP address?
ip.src ne 192.168.142.3
Nmap provides many commands and scripts that are used to evade firewalls and intrusion detection systems. Which of the following is the proper nmap command to use the decoy option?
nmap -D RND:25 10.10.10.1
Which of the following best describes a DoS attack?
A hacker overwhelms or damages a system and prevents users from accessing a service.
An attacker conducts an normal port scan on a host and detects protocols used by a Windows operating system and protocols used by a Linux operating system. Which of the following might this indicate?
A honeypot
As part of your penetration test, you are using Ettercap in an attempt to spoof DNS. You have configured the target and selected the dns_spoof option (see image). To complete the configuration of this test, which of the following MITM options should you select?
ARP Poisoning
Which of the following is the term used to describe what happens when an attacker sends falsified messages to link their MAC address with the IP address of a legitimate computer or server on the network?
ARP Poisoning
Which of the following IDS detection types compare behavior to baseline profiles or network behavior baselines?
Anomaly-based
An attacker may use compromised websites and emails to distribute specially designed malware to poorly secured devices. This malware provides an access point to the attacker, which he can use to control the device. Which of the following devices can the attacker use?
Any device that can communicate over the intranet can be hacked.
Which of the following best describes the key difference between Dos and DDoS?
Attackers use numerous computers and connections.
Creating an area of the network where offending traffic is forwarded and dropped is known as?
Black hole filtering
Which of the following best describes the process of using prediction to gain session tokens in an Application level hijacking attack?
Collect several session IDs that have been used before and then analyze them to determine a pattern.
SQL injections are a result of which of the following flaws?
Web applications
You are analyzing the web applications in your company and have newly discovered vulnerabilities. You want to launch a denial-of-service (DOS) attack against the web server. Which of the following tools would you most likely use?
WebInspect
Which of the following types of web server attacks is characterize by altering or vandalizing a website's appearance in an attempt to humiliate, discredit, or annoy the victim?
Website defacement
You suspect that an ICMP flood attack is taking place from time to time, so you have used Wireshark to capture using the tcp.flags.syn==1 filter. Initially, you saw an occasional SYN or ACK packet. After a short while, however, you started seeing packets as shown in the image. Using the information shown, which of the following explains the difference between normal ICMP (ping) requests and an ICMP flood?
With the flood, all packets come from the same source IP address in quick succession.
When it comes to obfuscation mechanisms, nmap has the ability to generate decoys, meaning that detection of the actual scanning system becomes much more difficult. Which of the following is the proper nmap command?
nmap -D RND:10 target_IP_address
You have been asked to perform a penetration test for a company to see if any sensitive information can be captured by a potential hacker. You have used Wireshark to capture a series of packets. Using the tcp contains Invoice filter, you have found one packet. Using the captured information shown, which of the following is the account manager's email address?
Which of the following is the process of determining the configuration of ACLs by sending a firewall TCP and UDP packets?
Firewalking
You have just captured the following packet using Wireshark and the filter shown. Which of the following is the captured password?
St@y0ut!@
Which of the following best describes source routing?
The packet's sender designates the route that a packet should take through the network.
Which of the following explains why web servers are often target by attackers?
Web servers provide an easily found, publicly accessible entrance to a network that users are encouraged to enter into and browse.
A security analyst is using tcpdump to capture suspicious traffic detected on port 443 of a server. The analyst wants to capture the entire packet with hexadecimal and ascii only. Which of the following tcpdump options will achieve this output?
-SX port 443
The ping command is designed to test connectivity between two computers. There are several command options available to customize ping, making it a useful tool for network administrators. On Windows, the default number of ping requests is set is four. Which of the following command options will change the default number of ping requests?
-n
Which of the following HTTP response messages would you receive of additional action needs to be taken to complete the request?
3xx Redirection
As the cybersecurity specialist for your company, you have used Wireshark to check for man-in-the-middle DHCP spoofing attacks using the bootp filter. After examining the results, what is your best assessment?
A man-in-the-middle spoofing attack is possible due to two DHCP ACK packets.
Which of the following best describes the SQL Power Injector tool?
A tool used to find SQL injections on a web page.
Which of the following best describes a web application?
A web application is software that has been installed on a web server.
Which of the following best describes Microsoft Internet Information Services (IIS)?
A web server technology
You have been asked to perform a penetration test to see if any sensitive information can be captured by a potential hacker. You have used Wireshark to capture a series of packers. Using the tcp contains Invoice filter, you have found one packet. Using the captured information shown, which of the following is the name of the company requesting payment?
ACME, Inc
As the cybersecurity specialist for your company, you believe a hacker is using ARP poisoning to infiltrate your network. To test your hypothesis, you have used Wireshark to capture packets and then filtered the results. After examining the results, which of the following is your best assessment regarding ARP poisoning?
ARP poisoning is occurring, as indicated by the duplicate response IP address.
Which of the following is a password cracking tool that can make over 50 simultaneous target connections?
Brutus
HTTP headers can contain hidden parameters such as user-agent, host headers, accept, and referrer. Which of the following tool could you use to discover hidden parameters?
Burp Suite
Web applications use sessions to establish a connection and transfer sensitive information between a client and a server. Attacking an application's session management mechanisms can help you get around some of the authentication controls an allow you to use the permissions of more privileged application users. Which of the following type of attacks could you use to accomplish this?
Cookie parameter tampering
As a penetration tester, you have found there is no data validation being completed at the server, which could leave the web applications vulnerable to SQL attacks. Which of the following could you use to help defend against this vulnerability?
Decline any entry that include binary input, comment characters, or escape sequences.
Robin, an IT technician, has implemented identification and detection techniques based on the ability to distinguish legitimate traffic over the network. Which of the following is he trying to achieve?
Defend the network against IDS evasions.
Which of the following best describes a stateful inspection?
Determines the legitimacy of traffic based on the state of the connection from which the traffic originated.
The following are countermeasures you would take against a web application attack: 1. Secure remote administration and connectivity testing. 2. Perform extensive input validation. 3. Configure the firewall to deny ICMP traffic. 4. Stop data processed by the attacker from being executed.
DoS attacks
As part of your penetration test, you have captured an FTP session, as shown below. Which of the following concerns or recommendations will you include in your report?
FTP uses clear text passwords.
You are working on firewall evasion countermeasure and are specifically looking for a tool to expose TTL vulnerabilities. Which of the following tools would you use?
Firewalking
Gather information about a system, its components, and how they work together is known as?
Footprinting
A hacked has discovered UDP protocol weaknesses on a target system. The hacker attempts to send large numbers of UDP packets from a system with a spoofed IP address, which broadcasts out to the network in an attempt to flood the target system with an overwhelming amount of UDP responses. Which of the following DoS attacks is the hacker attempting to use?
Fraggle Attack
What of the following functions does a single quote (') perform in an SQL injection?
Indicates that data has ended and a command is being entered.
Which of the following best describes a proxy server?
Operates at Layer 7 (Application) of the OSI model.
Which of the following firewall technologies operates at Layers 3 (Network) and 4 (Transport) of the OSI model?
Packet filtering
Which of the following is characterized by an attacker using a sniffer to monitor traffic between a victim and a host?
Passive Hijacking
While performing a penetration test, you captured a few HTTP POST packets using Wireshark. After examining the selected packet, which of the following concerns or recommendations will you include in your report?
Passwords are being sent in clear text.
Which of the following best describes the HTTP Request/Reponse TRACE?
Performs a loopback test to a target resources.
You are using Wireshark to try and determine if a denial-of-service (DDoS) attack is happening on your network (128.28.1.1). You previously captured packets using the tcp.flags.syn==1 and tcp.flags.ack==1 filter, but only saw a few SYN-ACK packets. You have now changed the filter to tcp.flags.syn==1 and tcp.flags.ack==0. After examining the Wireshark results shown in the image, which of the following is the best reason to conclude that a DDoS attack is happening?
There are multiple SYN packets with different source addresses destined for 128.28.1.1
Which of the following statements is true regarding cookies?
They were created to store information about user performances and web activities.
An IDS can perform many types of intrusion detection. Three common detection methods are signature-based, anomaly-based, and protocol based. Which of the following best describes protocol-based detection?
This detection method can include malformed messages and sequencing errors.
Which of the following tools enables security professional to audit and validate the behavior of security devices?
Traffic IQ Professional
An IT technician receives an IDS alert on the company network she manages. A seemingly random user now has administration privileges in the system, some files are missing, and other files seem to have been just created. Which of following alerts did this technician receive?
True Positive
Using sniffers has become one way for an attacker to view and father network traffic. If an attacker overcomes your defenses and obtains network traffic, which of the following is the best countermeasure for securing the captured network traffic?
Use encryption for all sensitive traffic.
Which of the following web server countermeasures is implemented to fix known vulnerabilities, eliminate bugs, and improve performance?
Install patches and updates.
There are several types of signature evasion techniques. Which of the following best describes the obfuscated codes technique?
Is an SQL statement that is hard to read and understand.
The SQL injection methodology has four parts. Which of the following parts is similar to playing the game 20 questions?
Launch a SQL attack
Which of the following best describes the countermeasure you would take against a cross-site request forgery attack?
Log off immediately after using a web application. Clear the history after using a web application, and don't allow your browser to save your login details.
Which term describes the process of sniffing traffic between a user and server, then re-directing the traffic to the attacker's machine, where malicious traffic can be forwarded to either the user or server?
Man-in-the-middle
Which of the following steps in the web server hacking methodology involves setting up a web server sandbox to gain hands-on experience attacking a web server?
Mirroring
Which of the following is another name for the signature-based detection method?
Misuse detection
You are looking for a web application security tool that runs automated scans looking for vulnerabilities susceptible to SQL injection, cross-site scripting, and remote code injection. Which of the following web application security tools would you most likely use?
Netsparker
Penetration testing is a practice conducted by an ethical hacker to see how an organization's security policies and security practices measure up to the organization's actual overall successful system security. When can an ethical hacker start the penetration test?
Once all the legal contracts are signed, formalities are settled, and permissions are give.
Using Wireshark, you have used a filter to help capture only the desired types of packets. Using the information shown in the image, which of the following best describes the effects of using the host 192.168.0.34 filter?
Only packets with 192.168.0.34 in either the source of destination address are captured.
Using Wireshark, you have used a filter to help capture only the desired types of packets. Using the information shown in the image, which of the following best describes the effects of using the net 192.168.0.0 filter?
Only packets with either a source or destination address on the 192.168.0.0 network are captured.
Which of the following types of injections can be injected into conversations between an application and a server to generate excessive amounts of spam email?
SMTP injection
Your network administrator has set up training for all the users regarding clicking on links in emails or instant messages. Which of the following is your network administrator attempting to prevent?
Session Fixation
A penetration tester discovers a vulnerable application and is able to hijack a website's URL hyperlink session ID. The penetration tester is able to intercept the session ID; when the vulnerable application sends the URL hyperlink to the website, the session IDs are embedded in the hyperlink. Which of the following types of session hijacking countermeasures is the penetration tester using?
Session Fixation Attack
Which of the following tools can be used to create botnets?
Shark, PlugBot, and Poison Ivy
Your network administrator is configuring settings so the switch shuts down a port when the max number of MAC addresses is reached. What is the network administrator taking countermeasures against?
Sniffing
Allen, the network administrator, needs a tool that can do network intrusion prevention and intrusion detection, capture packets, and monitor information. Which of the following tools would he most likely select?
Snort
ARP, DNS, and IP are all examples of which of the following?
Spoofing methods.
Which of the following firewall limitations is a critical vulnerability because it means that packet filters cannot tell whether a connection was started inside or outside of the organization?
In ability to detect the keep the state status.
What are the two types of Intrusion Detection Systems (IDSs)?
HIDS and NIDS
You are looking for a web server security tool that will detect hidden malware in websites and advertisements. Which of the following security tools would you most likely use?
Hackalert
Which of the following motivates attackers to use Dos and DDos attacks?
Hacktivism, profit, and damage reputation
Jessica needs to set up a firewall to protect her internal network from the Internet. Which of the following would be the best type of firewall for her to use?
Hardware
An attacker is attempting to connect to a database using a web application system account instead of user-provided credentials, Which of the following methods is the attacker attempting to use?
Hijacking web credentials
Lorena, the CIO, wants to ensure that the company's security practices and policies match well with their firewall security configuration for maximum protection against hacking. Which of the following actions should Lorena take?
Hire a penetration tester.
You are on a Windows system. You receive an alert that a file named MyFile.txt had been found. Which of the following could this indicate?
Host-based IDS
Which of the following are protocols included in the IPsec architecture?
IKE, AH, and ESP
Which of the following protocols is one of the most common methods used to protect packet information and defend against network attacks in VPNs?
IPsec
